CVE-2024-21733 — Information Exposure via Error Message in Apache Tomcat

CWE-209 — Information Exposure via Error Message11 documents10 sources
Severity
5.3MEDIUMNVD
EPSS
73.4%
top 1.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache TomcatApache Software Foundation Apache Tomcat
Timeline
PublishedJan 19
Latest updateJun 9

Description

Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. Other, EOL versions may also be affected. Users are recommended to upgrade to version 8.5.64 onwards or 9.0.44 onwards, which contain a fix for the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDapache/tomcat8.5.7 — 8.5.64+2
▶CVEListV5apache_software_foundation/apache_tomcat8.5.7 — 8.5.63+1

Patches

Patch: lists.apache.org ↗Patch: www.openwall.com ↗Patch: lists.apache.org ↗

🔴Vulnerability Details

4
OSV
CVE-2024-21733: Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat↗2024-01-19
▶
OSV
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information↗2024-01-19
▶
GHSA
Apache Tomcat vulnerable to Generation of Error Message Containing Sensitive Information↗2024-01-19
▶
CVEList
Apache Tomcat: Leaking of unrelated request bodies in default error page↗2024-01-19
▶

📋Vendor Advisories

4
Ubuntu
Tomcat vulnerabilities↗2025-06-09
▶
Red Hat
tomcat: Leaking of unrelated request bodies in default error page↗2024-01-19
▶
Debian
CVE-2024-21733: tomcat9 - Generation of Error Message Containing Sensitive Information vulnerability in Ap...↗2024
▶
Apache
Apache tomcat: CVE-2024-21733↗
▶

📄Research Papers

1
CTF
SIFI / README↗2024
▶

💬Community

1
HackerOne
CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)↗2024-01-29
▶
CVE-2024-21733 — Information Exposure via Error Message | cvebase